1. Field of the Invention
This invention pertains in general to computer security and in particular to preventing a worm or other malicious and/or unauthorized software from executing on a computer system.
2. Description of the Related Art
A “worm” is a computer program that attempts to infect multiple computer systems. There are a number of ways a worm can initially execute on a computer system. For example, an end-user might unintentionally download the worm from the Internet as a parasitic virus attached to a program. Alternatively, a worm might infect the computer system using transmission media such as email scripts, buffer overflow attacks, password cracking, etc.
Typically, the primary purpose of a worm is to spread to other computer systems. However, a worm can also include functionality to infect files on the computer system, destroy data on the computer system, and/or perform other malicious actions. A successful worm spreads rapidly and can quickly damage many computer systems.
An enterprise such as a corporation usually has multiple computer systems connected by a network. Each computer system has a local storage device, such as a hard drive. Many computer systems use a technique called “drive sharing” to make the contents of the storage devices accessible to the other computer systems on the network. Drive sharing often increases the productivity of the enterprise because it allows the end-users to easily share data contained on their computer systems.
However, one particularly virulent breed of worms uses drive sharing to quickly spread through the computer systems on an enterprise's network. These drive sharing worms can ravage an entire corporate network in hours by copying themselves from hard drive to hard drive over open network drive shares. Drive sharing worms are difficult to eradicate because a disinfected computer system is quickly re-infected via the network.
One technique for preventing worm attacks and virus infections is to install anti-virus software on the computer system in order to detect the presence of worms, viruses, and other malicious software. However, it is sometimes not practical to use anti-virus software on certain computer systems. Moreover, anti-virus software might fail to detect previously unknown worms. In addition, certain types of worms use programming techniques, such as polymorphism or metamorphism, that hamper the effectiveness of anti-virus software.
Accordingly, there is a need in the art for a way to detect and block drive sharing worms and other types of malicious software.